agent

package

v0.9.0 Latest Latest Go to latest Published: Oct 14, 2026 License: Apache-2.0 Imports: 10 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/kube-workspaces/api

Links

Open Source Insights

Documentation ¶

Constants ¶

View Source

const DefaultTTL = 60 * time.Second

DefaultTTL is the ticket lifetime; the proxy renews at half of it.

View Source

const Protocol = 1

Protocol is the wire protocol version this ticket store serves.

Variables ¶

This section is empty.

Functions ¶

This section is empty.

Types ¶

type Session ¶

type Session struct {
	ID        string
	Ticket    Ticket
	ExpiresAt time.Time
}

Session is a server-side attach record: the id the proxy renews and releases by, plus a snapshot of the ticket it was minted from.

type Store ¶

type Store struct {
	// contains filtered or unexported fields
}

Store mints, validates and tracks ticket sessions in memory. Sessions end with the process; clients fall back to the console path (documented in the indicator contract — no silent persistence is claimed).

func NewStore ¶

func NewStore() *Store

NewStore returns a Store with the default TTL and real clock.

func (*Store) Active ¶

func (s *Store) Active(workspaceUID string) int

Active counts live (unexpired) sessions bound to a workspace UID. Expired records are swept as observed, never resurrected.

func (*Store) Lookup ¶

func (s *Store) Lookup(id string) (*Session, bool)

Lookup returns the live session record for renew/release correlation.

func (*Store) Mint ¶

func (s *Store) Mint(workspaceUID, workspaceGeneration, participant string, epoch uint64, keys [][]byte) (id, ticket string, err error)

Mint creates a session and returns its id plus the signed ticket string ("id.payload.signature"). The ticket's SessionID is empty: it binds the live claim, correlated server-side by id.

func (*Store) Parse ¶

func (s *Store) Parse(signed string, keys [][]byte) (Ticket, error)

Parse validates signature (any rotation key) and expiry, returning the ticket payload. It does not check workspace binding — the caller does.

func (*Store) Release ¶

func (s *Store) Release(id string)

func (*Store) Renew ¶

func (s *Store) Renew(id string) (time.Time, bool)

Renew extends a live session by one TTL. Expired or unknown ids fail closed (the proxy drops the bridge; the viewer re-attaches).

type Ticket ¶

type Ticket struct {
	WorkspaceUID        string `json:"workspaceUid"`
	WorkspaceGeneration string `json:"workspaceGeneration"`
	SessionID           string `json:"sessionId"`
	Participant         string `json:"participant"`
	Role                string `json:"role"`
	ControlEpoch        uint64 `json:"controlEpoch"`
	Audience            string `json:"audience"`
	IssuedAtNs          int64  `json:"issuedAtNs"`
	ExpiresAtNs         int64  `json:"expiresAtNs"`
}

Ticket binds one attach grant. JSON tags are camelCase to match the guest agent's wire structs exactly.

Source Files ¶

View all Source files

agent.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL